1

I'm disassembling a large ARM binary and I see that for some functions both Ghidra and Radare2 appear to fail to disassemble certain functions whereas Hopper works for those same functions

In Ghidra - I see question marks at the (correct) address disassembly

                         LAB_1006750e0                                   XREF[1]:     1006750d0(j)  
   1006750e0 00 00 80 d2     mov        x0,#0x0
   1006750e4 f4 03 13 aa     mov        x20,x19
   1006750e8 b0 00 00 94     bl         FUN_1006753a8                                    undefined FUN_1006753a8()
   1006750ec f0 ff ff 17     b          LAB_1006750ac
   1006750f0 e2              ??         E2h
   1006750f1 f3              ??         F3h
   1006750f2 ff              ??         FFh
   1006750f3 10              ??         10h
   1006750f4 1f              ??         1Fh
   1006750f5 20              ??         20h     
   1006750f6 03              ??         03h
   ...

In radare2 - after seeking to the address and running af and pdf, I get: "Linear size differs too much from the bbsum, please use pdr instead."

What can I do here to get these functions to disassemble in Ghidra and radare2?

1 Answer 1

-1

I can only address the Ghidra-part of your question:

Generally speaking, you can always instruct Ghidra to create a function at a given position by marking it and hitting F (default key binding for "Create Function" of the "FunctionPlugin) or by selecting "Create Function" from the context menu.

The question marks are there because Ghidra couldn't or didn't disassemble this part and hence doesn't have any assembly instructions to display. But this may change as soon as you create a function.

Concretely, right click on 1006750f0 and select "Create Function" from the context menu. This should give you both a disassembly and a decompiled function.

Another general remark: Function identification is a hard problem and there are a lot of different algorithms and heuristics used by different tools (IDA, radare2, Hopper, Ghidra, ...) to approach it. None of those is perfect and sometimes some of those tools perform better then others.

1
  • The disassembly stopped because that is the end of that flow, it's an unconditional branch, you need to probably go higher up (lower address) to find the correct entry point for this code. Pressing 'd' for disassemble will generate assembly code.
    – mumbel
    Nov 2, 2020 at 17:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.